Upgrade Splunk App for SOAR Export on Splunk Enterprise

Upgrade Splunk App for SOAR Export to ensure that you can use the full functionality of the add-on.

Before you begin

Before upgrading Splunk App for SOAR Export, back up your files from the command line by copying the complete directory $SPLUNK_HOME/etc/apps/phantom to another location that's not under $SPLUNK_HOME/etc/apps.

Steps to upgrade Splunk App for SOAR Export

To upgrade to the current Splunk App for SOAR version, complete the following steps in order:

  1. Upgrade to the corresponding Splunk CIM (Splunk Common Information Model) version for this release or install Splunk Enterprise Security. Refer to the Splunk product compatibility matrix for details.
  2. Upgrade to this version of Splunk App for SOAR Export.
Note: Check the the Splunk product compatibility matrix for exact versions.

Detailed steps:

  1. From Splunkbase, download the corresponding version of Splunk CIM or Splunk Enterprise Security.
  2. Go to your Splunk Enterprise instance.
  3. In the apps panel, click the gear icon.
  4. Select Install app from file.
  5. Upload the app file you downloaded from Splunkbase.
  6. Select the checkbox to upgrade the add-on. Making this selection overwrites the add-on if it already exists.
  7. Your Splunk Enterprise instance restarts to complete the upgrade.
  8. Repeat the previous steps, downloading this version of Splunk App for SOAR Export from Splunkbase.